CVE-2026-116200 - Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()
CVE ID :CVE-2026-116200 Published : Oct. 25, 2026, 2:17 p.m. | 2 hours, 5 minutes ago Description :Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with...